dApplooker

Upon deployment, the expected contract owner would have to call initialize( ) else the owner characteristics and privileges do not get set. This is an issue for two reasons:Scenario 1: Initialize is frontrun by a malicious actor If anyone asides from the intended owner calls initialize, they automatically become the owner of this PaymentVault contract with the privileges required to call withdraw on any of the deposited tokens. Bots could be listening on the network for scenarios set up just like this and take advantage of the exploit opportunity. Once the attacker is approved, they can set the owner to an auto-drain contract that immediately removes any deposits made into the vault. This could defeat the goal of having the contract act as a vault until needed. Scenario 2: Initialize does not get called by anyone This would make the owner variable set to address(0), and the withdraw function will be unusable since address(0) currently does not have a signer and cannot pass the onlyOwner check.

If renouncing ownership is not done appropriately, the current contract owner can renounce ownership, lose owner privileges, and lose access to the tokens sent to the contract forever. When ownership is renounced, functions like withdraw will be uncallable and any tokens gotten from transactions, or even mistaken deposits into the contract will be inaccessible.

The current logic of this contract allows only the owner to withdraw deposited tokens. This means User A can make a deposit but would never be able to withdraw their deposited tokens unless they were the deployers of the contract and/or the caller of the initialize function.

The events emitted in the contract could be indexed to allow for easy searching for addresses that made deposits and the different tokens that were added in.

The solidity pragma version in this codebase is unlocked.